St vulnerabilities
29 vulnerabilities
Known vulnerabilities in St products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 123 products.
Products
50 of 123- X Cube Azrt H7Rs7 vulnerabilities
- X Cube Azrtos F47 vulnerabilities
- X Cube Azrtos F77 vulnerabilities
- X Cube Azrtos G07 vulnerabilities
- X Cube Azrtos G47 vulnerabilities
- X Cube Azrtos H77 vulnerabilities
- X Cube Azrtos L47 vulnerabilities
- X Cube Azrtos L57 vulnerabilities
- X Cube Azrtos Wb7 vulnerabilities
- X Cube Azrtos Wl7 vulnerabilities
- Stm32Cube Middleware6 vulnerabilities
- Stm32Cubel43 vulnerabilities
- J Safe32 vulnerabilities
- Stm32F42 vulnerabilities
- Stm32F72 vulnerabilities
- Stm32H72 vulnerabilities
- Stm32L02 vulnerabilities
- Stm32L12 vulnerabilities
- Stm32L42 vulnerabilities
- Stsafe J2 vulnerabilities
- Bluenrg 21 vulnerabilities
- Ftp Service1 vulnerabilities
- St33Tphf20I2C1 vulnerabilities
- St33Tphf20Spi1 vulnerabilities
- St33Tphf2Ei2C1 vulnerabilities
- St33Tphf2Espi1 vulnerabilities
- St54 Android Packages Apps Nfc1 vulnerabilities
- Stm32 Mw Usb Host1 vulnerabilities
- Stm32Cubef01 vulnerabilities
- Stm32Cubef11 vulnerabilities
- Stm32Cubef21 vulnerabilities
- Stm32Cubef31 vulnerabilities
- Stm32Cubef41 vulnerabilities
- Stm32Cubef71 vulnerabilities
- Stm32Cubeg01 vulnerabilities
- Stm32Cubeg41 vulnerabilities
- Stm32Cubeh71 vulnerabilities
- Stm32Cubeide1 vulnerabilities
- Stm32Cubel01 vulnerabilities
- Stm32Cubel11 vulnerabilities
- Stm32Cubel51 vulnerabilities
- Stm32Cubemonitor1 vulnerabilities
- Stm32Cubemp11 vulnerabilities
- Stm32Cubemx1 vulnerabilities
- Stm32Cubeprogrammer1 vulnerabilities
- Stm32Cubewb1 vulnerabilities
- Stm32Cubewl1 vulnerabilities
- Stm32F030C61 vulnerabilities
- Stm32F030C81 vulnerabilities
- Stm32F030Cc1 vulnerabilities
CVE-2003-0392stftp_service
EPSS score1.40%
Directory traversal vulnerability in ST FTP Service 3.0 allows remote attackers to list arbitrary directories via a CD command with a DoS drive letter argument (e.g. E:).CVE-2021-42553ubuntumicropython+2EPSS score1.27%
A buffer overflow vulnerability in stm32_mw_usb_host of STMicroelectronics in versions before 3.5.1 allows an attacker to execute arbitrary code when the descriptor contains more endpoints than USBH_MAX_NUM_ENDPOINTS. The library is typically integrated when using a RTOS such as FreeRTOS on STM32 MCUs.CVE-2021-43393stj-safe3_firmware+1EPSS score0.15%
STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to abuse signature verification. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.CVE-2021-43392stj-safe3_firmware+1EPSS score0.17%
STMicroelectronics STSAFE-J 1.1.4, J-SAFE3 1.2.5, and J-SIGN sometimes allow attackers to obtain information on cryptographic secrets. This is associated with the ECDSA signature algorithm on the Java Card J-SAFE3 and STSAFE-J platforms exposing a 3.0.4 Java Card API. It is exploitable for STSAFE-J in closed configuration and J-SIGN (when signature verification is activated) but not for J-SAFE3 EPASS BAC and EAC products. It might also impact other products based on the J-SAFE-3 Java Card platform.CVE-2021-29414ststm32cubel4_firmwareEPSS score0.34%
STMicroelectronics STM32L4 devices through 2021-03-29 have incorrect physical access control.CVE-2021-34262ststm32cube_middlewareEPSS score0.48%
A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.CVE-2021-34268ststm32cube_middlewareEPSS score0.36%
An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) via a malformed USB device packet.CVE-2021-34261ststm32cube_middlewareEPSS score0.36%
An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to set a remote wake-up feature.CVE-2021-34267ststm32cube_middlewareEPSS score0.36%
An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) when the system tries to communicate with the connected endpoint.CVE-2021-34260ststm32cube_middlewareEPSS score0.48%
A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.CVE-2021-34259ststm32cube_middlewareEPSS score0.48%
A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.CVE-2020-13466ststm32f103_firmwareEPSS score0.41%
STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakpoint unit configuration.CVE-2020-20949ietfpublic_key_cryptography_standards_\#1+20EPSS score0.94%
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.CVE-2020-27212ststm32cubel4_firmwareEPSS score0.34%
STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no access via debug interface) to level 1 (limited access via debug interface) by injecting a fault during the boot phase.CVE-2020-8004ststm32f1_firmwareEPSS score3.05%
STMicroelectronics STM32F1 devices have Incorrect Access Control.CVE-2017-18347ststm32f030c6_firmware+71EPSS score0.40%
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.CVE-2024-45064stx-cube-azrt-h7rs+19EPSS score1.11%
A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted set of network packets can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability.CVE-2024-50595stx-cube-azrt-h7rs+19EPSS score0.78%
An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted series of network requests can lead to denial of service. An attacker can send a sequence of malicious packets to trigger this vulnerability.This vulnerability affects the NetX Duo Component HTTP Server implementation which can be found in x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.cCVE-2024-50384stx-cube-azrt-h7rs+19EPSS score0.78%
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Web Component HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\web\nx_web_http_server.cCVE-2024-50385stx-cube-azrt-h7rs+19EPSS score0.78%
A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted network packet can lead to denial of service. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability affects X-CUBE-AZRTOS-F7 NetX Duo Component HTTP Server HTTP server v 1.1.0. This HTTP server implementation is contained in this file - x-cube-azrtos-f7\Middlewares\ST\netxduo\addons\http\nxd_http_server.c